Types of AI technology

A full breakdown of AI techniques and corresponding references is available in Table 2 and detailed in Supplementary Appendix B.

Table 2.

AI technology categories distribution

Machine learning (ML) was the dominant technique, used in 75% of the 100 studies. This technique often relies on supervised algorithms such as logistic regression, random forests, or gradient boosting to support tasks like infection risk prediction and HAIs surveillance based on EHRs or sensor data. For more details, see next section on IPC applications blocks.

Deep learning approaches appeared in 21 studies (21%) and included for example the use of convolutional neural networks (CNNs) technologies for surface contamination detection ^{Reference Abubeker60} but also on video-based hand hygiene monitoring, ^{Reference Kim, Choi, Jo, Kim, Kim and Kim63} surgical site infections (SSI), ^{Reference Asif, Xu and Zhao96} and early detection of multidrug-resistant infections. ^{Reference Gouareb, Bornet, Proios, Pereira and Teodoro52}

Generative AI was used in just four studies (4%). These projects piloted large language models (LLMs) for IPC education, ^{Reference Jawanpuria, Behera, Dash and Rahman11} policy summarisation ^{Reference Chester and Mandler31} through expert consensus, HAI’s surveillance ^{Reference Wiemken and Carrico41} and Hand hygiene. ^{Reference Simioli, Annunziata and Coppola49}

IPC applications supported by AI distribution

Among the 100 primary studies, nine distinct IPC application areas were identified (Table 3 and Figure 2).

Figure 2.

IPC applications distribution.

Table 3.

IPC applications supported by AI distribution

Predictive-analytics systems accounted for 53% of the studies. These papers typically trained supervised models such as logistic regression, gradient boosting, or recurrent networks on electronic-health-record data to forecast patient-level risks such as, for example, central-line associated bacteremia, ^{Reference Montella, Ferraro, Sperlì, Triassi, Santini and Improta56,Reference Beeler, Dbeibo and Kelley39} Multi Drug Resistance (MDR) ^{Reference Kamruzzaman, Heavey and Song35,Reference Gouareb, Bornet, Proios, Pereira and Teodoro52} or SSI. ^{Reference Gutierrez-Naranjo12,Reference Bartz-Kurycki, Green and Anderson38,Reference Chen, Lu, You, Zhou, Xu and Chen74,Reference Fletcher, Schneider and Hedt-Gauthier107} In some cases, ward-level early-warning scores were generated by combining laboratory, vital-sign, and admission data streams. ^{Reference Montella, Ferraro, Sperlì, Triassi, Santini and Improta56}

Hand hygiene compliance monitoring was reported in 13 studies (13%), with applications varying through video analytics using CNNs, badge-based proximity sensors, ^{Reference Wang, Xia, Wu, Ni, Long, Li, Zhao, Chen, Wang, Xu, Huang and Lin17,Reference Asif, Xu and Zhao96} alcohol-dispenser sensors linked to compliance dashboards, ^{Reference Xu, Yang and Chen109} and optical microscopy with ML classification for hand contamination. ^{Reference Claudinon, Steltenkamp and Fink40}

Thirteen studies (13%) focused on HAI detection, applying classification algorithms, microbiology, imaging, or pharmacy records to flag active infections such as SSI, ^{Reference Wu, Tsai, Ho, Lai, Tai and Lin36,Reference Kiser, Shi and Bucher64,Reference Bucher, Shi and Ferraro77,Reference Zhu, Simon and Wick76,Reference Colborn, Zhuang and Dyas79} central-line–associated bloodstream infection ^{Reference Roimi, Neuberger and Shrot94} or urinary tract infections (UTIs). ^{Reference van der Werff, Thiman and Tanushi86} Many of these tools operated continuously in clinical workflows. ^{Reference Abubeker60,Reference Verberk and van der Werff98}

Eight studies (8%) targeted HAI surveillance by aggregating time-series data for incidence-trend analysis. ^{Reference Rennert-May, Leal, MacDonald, Cannon, Smith, Exner, Larios, Bush and Chew25,Reference Lukasewicz Ferreira, Franco Meneses and Vaz54,Reference Flores-Balado, Méndez and González108} Automated case-finding rules were often calibrated against conventional manual surveillance ^{Reference Cho, Kim and Chung45} but also using Natural Language Processing (NLP) ^{Reference Shi, Liu and Pruitt29,Reference Tvardika, Kergourlay, Bittar, Segond, Darmoni and Metzger34,Reference dos Santos, Silva and Menezes72,Reference Flores-Balado, Méndez and González108} and Generative AI. ^{Reference Wiemken and Carrico41} Outbreak-detection models were described in four studies (4%). Approaches ranged from supervised clustering of ward alerts ^{Reference Atkinson, Ellenberger and Piezzi101} to whole-genome-sequencing pipelines that feed resistance-related single-nucleotide-polymorphism data into transmission-mapping algorithms. ^{Reference Sundermann, Chen and Miller42,Reference Sundermann, Chen and Miller43} One study integrated environmental IoT sensors to identify spatiotemporal hotspots. ^{Reference Bhatia, Sood and Kaur15}

Less-common themes included education and training platforms (3 %), where generative- or retrieval-augmented language models generated scenario-based learning modules ^{Reference Jawanpuria, Behera, Dash and Rahman11} or PPE monitoring through computer vision founded on Human-AI Collaboration; ^{Reference Kim, Park and Sippel44,Reference Segal, Bradley and Williams55} environmental monitoring (3 %), employing image recognition or air-quality sensors for surface-cleanliness verification; ^{Reference Hattori, Sekido, Leong, Tsutsui, Arima, Tanaka, Yokota, Washio, Kawai and Okochi27,Reference Hu, Zhong, Li, Tan and He69,Reference Lee, Shim and Lim106} and AMR prediction (1%), also using Plasmonic Nanosensors. ^{Reference Yu, Fu and He110} Finally, decision-support dashboards (2 %) evaluating ChatGPT’s reliability in agreeing with expert statements ^{Reference Chester and Mandler31} or risk stratification for UTIs ^{Reference Jakobsen59} were described in two studies.

Barrier profile

A total of 4 barrier categories were coded across 100 primary studies, clustering into nine composite categories (Table 4 and Figure 3).

Figure 3.

Barrier categories distribution.

Table 4.

Barrier categories

Data-related barriers were the most common, reported in 45 studies (45%), with issues such as incomplete records, non-standard terminologies, and delayed feeds. ^{Reference Cho, Lee, Kim, Yoo, Choi, Lee and Choi22,Reference Chester and Mandler31,Reference Bucher, Shi and Ferraro77,Reference Chen, Joisa and Stem78} Barriers combining technical and economic elements (16%) were also frequent. Examples included high setup and maintenance costs for AI surveillance tools, ^{Reference Kamruzzaman, Heavey and Song35} computational demands and complexity of real-time systems, ^{Reference Bartz-Kurycki, Green and Anderson38} and substantial infrastructure requirements for whole-genome sequencing pipelines. ^{Reference Sundermann, Chen and Miller42,Reference Sundermann, Chen and Miller43} A further 16% of studies reported barriers blending integration challenges with data shortcomings. Purely technical problems, including outages, high computational requirements, and sensor failures, appeared in 9%. Human factors coupled with data gaps, such as low trust or alert fatigue, were noted in 5%. Less frequent were mixed technical-human (3%), economic-data (3%), stand-alone economic (2%), and economic-human (1%) barriers.

Risk taxonomy

A total of 4 risk categories were coded across 100 primary studies, yielding eight composite categories (Table 5 and Figure 4). Risk reporting was highly granular, and many papers logged more than one category.

Figure 4.

Risk categories distribution.

Table 5.

Risk categories

Operational issues were the most frequently documented risk type, recorded in 35 of 100 studies (35%). These papers described, for example, over-reliance on predictions without clinical confirmation ^{Reference Gutierrez-Naranjo12,Reference Liang, Zhao, Xu, Zhou and Huang16} or potential misinterpretation if model outputs are not validated. ^{Reference Rabhi, Jakubowicz and Metzger18}

Technical failures followed closely, appearing in 33 studies (33%). Examples included server Risk of model overfitting ^{Reference Sun, Zuccarelli and Zerhouni71,Reference Marra, Alzunitan and Abosi73} or risk of under-detection in systems with incomplete digital documentation. ^{Reference Bucher, Shi and Ferraro77,Reference van der Werff, Thiman and Tanushi86}

Data-security concerns were reported in 12 studies (12%), typically focusing on patient or staff privacy regulations. ^{Reference Bhatia, Sood and Kaur15,Reference Zhang, White, Schmidt and Dennis37,Reference Xu, Yang and Chen109}

Combined technical-and-operational risks featured in nine studies (9 %), while paired operational-and-data-security risks were noted in four studies (4 %).

Pure human-factor risks, such as over-reliance on AI outputs ^{Reference Yu, Fu and He110} or diminished vigilance during downtimes, ^{Reference Balczewski and Keidan102} were documented in four studies (4 %). Two papers (2 %) combined technical and data-security risks, ^{Reference Shi, Liu and Pruitt29,Reference Shrimali and Teuscher32} and one study (1 %) reported a mixed human-and-data-security category. ^{Reference Simioli, Annunziata and Coppola49}

Digital-integration status

Of the 100 studies reviewed, only 15 papers (15 %) described AI tools already integrated into another digital layer of hospital or public health information systems. The main integration pathways were:

• • Automated surveillance shells, documented in 4 studies (4 %), which connected AI analytics to existing IPC dashboards. ^{Reference Bucher, Shi and Ferraro77,Reference Chen, Joisa and Stem78,Reference van der Werff, Thiman and Tanushi86,Reference Verberk and van der Werff98}

• • IoT data streams, featured in 2 studies (2 %), linking badge or environmental-sensor feeds to analytic engines.^15,60

• • Whole-genome sequencing pipelines, reported in 2 studies (2 %), integrating AI outbreak detection into genomic workflows. ^{Reference Sundermann, Chen and Miller42,Reference Sundermann, Chen and Miller43}

• • EHR-embedded models, described in 2 studies (2 %), integrating real-time AI tools directly into electronic health record systems to enable dynamic risk prediction and decision support within clinical workflows. ^{Reference Cotia, Scorsato and Prado58,Reference Colborn, Zhuang and Dyas79}

Furthermore, single studies (each 1 %) detailed integration via mHealth apps, ^{Reference Ke13} computer-vision systems, ^{Reference Kim, Park and Sippel44} computational-fluid-dynamics models, ^{Reference Lee, Shim and Lim106} wearable devices ^{Reference Xu, Yang and Chen109} and plasmonic nanosensors. ^{Reference Yu, Fu and He110}

The remaining 85 studies (85 %) reported prototypes without wider digital connectivity.

Checklist refinement and practical use

To help IPC teams assess readiness for adopting AI tools, we translated the findings of this review into a structured, evidence-informed checklist (Table 6). The checklist contains 41 items grouped into six domains reflecting the most common barrier clusters identified across the literature: Governance and Policy, Data Quality and Interoperability, Technical and Infrastructure, Human and Workflow, Risk and Compliance and Economic and Resource.

Table 6.

Structured readiness checklist for AI implementation in IPC

Each item was derived inductively from recurrent challenges and risks documented in the 100 included studies, ensuring that the checklist reflects real-world implementation experiences rather than theoretical considerations. To support practical use, two additional ratings were applied: maturity and priority.

By combining these two layers, IPC teams can gauge both how close their systems are to readiness and where to focus resources first. The maturity-priority framework thus transforms the checklist into a practical roadmap for planning, implementation, and risk mitigation.

The development of these scales followed a four-step, evidence-informed process:

1. 1. Thematic synthesis: reviewers inductively coded implementation barriers and risks from the included studies and organized them into the six checklist domains.

2. 2. Item drafting: recurring, actionable challenges within each domain were translated into checklist items.

3. 3. Maturity anchors: the 4-level maturity scale was defined to reflect observable progression from non-existent capacity to embedded practice. This structure aligns with established digital health maturity concepts such as the Healthcare Information and Management Systems Society’s (HIMSS) Electronic Medical Record Adoption Model (EMRAM) ¹¹¹ and with implementation science frameworks on organizational readiness such as the Consolidated Framework for Implementation Research (CFIR). ^{Reference Damschroder, Aron and Keith112}

4. 4. Priority criteria: item priority was determined using risk-management principles (safety and regulatory criticality, dependency and sequencing, feasibility and resource burden), aligned with two normative governance frameworks central to this review—the WHO guidance on ethics and governance of AI in health ⁶ and the EU Artificial Intelligence Act, ⁷ which classifies AI applications by risk. This ensures that high-priority items correspond to safeguards required for high-risk use cases.

The maturity scale was designed as a four-point ordinal measure:

• • 0—Absent: no sign AI solution has been considered.

• • 1—Emergent: early steps are present (e.g., draft policy, small pilot, budget line), but the system is not yet operational.

• • 2—Functional: the system is operational but limited in scope or reliability.

• • 3—Mature: the element is fully embedded, routinely monitored, and continuously improved.

This progression mirrors patterns observed in the literature, moving from complete absence of capacity (eg, no data stewardship), through pilots and partial functionality, to fully institutionalized, monitored systems. A neutral midpoint was deliberately excluded to encourage decisive appraisal of whether an element is operational or still requires attention.

The priority scale distinguishes between:

• • High Priority items, which are essential for safe and effective AI use, such as complete data, model accuracy, cybersecurity, and legal compliance.

• • Medium Priority items, which facilitate adoption and sustainability over time, including vendor support, return-on-investment data, or stress-testing of alert volumes.